CVE-2026-73170

Executive Summary

CVE-2026-73170 is a CWE-94 code injection vulnerability in the Modbus CSV import workflow of the Advantech EKI-1242EIMS industrial Ethernet switch/gateway running firmware V1.06.01. A remote authenticated attacker can supply a crafted CSV file that causes arbitrary Lua code execution on the device. Because the affected product is an industrial edge device, successful exploitation can grant attackers full control of the device's logic, enabling lateral movement and disruption of Modbus-based OT networks.

Technical Analysis

Advantech EKI-1242EIMS is an industrial Ethernet-to-Modbus gateway (often deployed at the IT/OT boundary to bridge Modbus RTU/TCP field devices with IP networks). Firmware V1.06.01 includes an import utility that ingests Modbus point/register mappings from CSV files supplied through the web management interface.

The vulnerability disclosed by Nozomi Networks Labs is classified as CWE-94 — Improper Control of Generation of Code ("Code Injection"). The device's Modbus configuration workflow passes attacker-controlled CSV field content into an interpreter/execution context without adequate sanitization or type validation. The observed impact is arbitrary Lua execution on the device: because embedded firmware management stacks frequently use a Lua interpreter for scripting, configuration parsing, or automation logic, unsanitized CSV cells are interpreted as executable Lua rather than inert data.

Attack surface and preconditions:

• Network reachability to the device's web/management interface (remote vector, AV:N under the described profile).
• Valid authenticated credentials for the device (PR:L) — the import workflow is a post-authentication administrative function.
• Ability to upload or supply a CSV file through the Modbus import feature.
• No user interaction beyond the authenticated attacker's own actions (UI:N).

The specific CSV column names, parsing function names, and interpreter invocation path are not disclosed in the CVE description and cannot be asserted here. The vulnerability class, however, is well understood: any parser that evaluates imported content (rather than treating it as data) allows the importer to become a code-execution primitive. Because the execution context is the device's Lua runtime, injected code inherits the privileges of the importing service — typically root-level or equivalent on embedded Linux firmware.

The absence of a CVSS vector or score from the NVD/CNA record means no authoritative numeric severity is published; the vector shown above reflects the described access profile (network, authenticated, no UI, high confidentiality/integrity/availability impact) and should be treated as analyst-inferred, not vendor-assigned.

Exploitation Scenarios

No public proof of concept, exploit code, or Nuclei template exists for CVE-2026-73170, so the following chain is inferred from the vulnerability class (CWE-94 code injection via file import) and the vendor/product context.

1. Reconnaissance / target identification An attacker enumerates internet-exposed or internally reachable Advantech EKI-series management interfaces using Shodan/Censys queries and/or network scanning of Modbus/TCP (port 502) and HTTPS management ports. Banner, title, and certificate metadata help fingerprint the device family and firmware line. The attacker obtains valid credentials through prior compromise, credential reuse, default-credential abuse, or social engineering — authentication is a prerequisite per the CVE description.

2. Triggering the flaw The attacker authenticates to the device's web management interface and navigates to the Modbus configuration/CSV import workflow. They craft a CSV file whose cell content, when parsed by the device's import routine, is evaluated by the Lua interpreter rather than treated as an inert register/point value. The exact delimiters and expected column layout are discoverable from a benign export of existing mappings, which the attacker can produce from the same UI.

3. Payload execution (vulnerability-class level) Because the unsafe eval/parse path executes Lua, the injected content runs as Lua code within the importing service's process context. At the class level, an attacker would embed Lua statements that perform OS command execution, write files, or open a reverse shell — but the precise API surface exposed to the Lua runtime on this firmware is not documented in the CVE record and is not asserted here. The critical property is attacker-chosen code executing on the device.

4. Post-exploitation impact With arbitrary Lua execution on an industrial gateway, an attacker can:

   • Persist by modifying device configuration or startup scripts.
   • Pivot into the OT network segment by reconfiguring Modbus routing, polling parameters, or access lists.
   • Manipulate process data by altering the point map, causing upstream SCADA/DCS to read falsified or missing values.
   • Use the device as a foothold for further lateral movement toward PLCs and HMIs reachable from the gateway. Because the device sits at the IT/OT boundary, compromise effectively collapses that segmentation boundary.

Impact Assessment

Business impact is high for organizations running Advantech EKI-1242EIMS at industrial sites. An attacker with valid credentials can convert a routine configuration import into full code execution, which on an industrial gateway translates into control over how process data flows between Modbus field devices and supervisory systems.

Blast radius: any Modbus-connected PLC, RTU, or sensor reachable through the gateway can be indirectly affected via manipulated routing or point mappings. Downstream consumers (SCADA, historians, MES) may ingest falsified telemetry. If the gateway participates in safety-relevant monitoring, integrity loss (I:H) can mask dangerous process conditions.

CVSS subscores to weigh (analyst-inferred vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H):

• AV:N — the import function is reachable over the network.
• AC:L — no special conditions are described beyond having a crafted CSV.
• PR:L — valid credentials are required.
• UI:N — no victim interaction is required after the attacker authenticates.
• S:U — scope is unchanged; the vulnerable component's security authority is what is subverted.
• C/I/A:H — arbitrary code execution on an embedded gateway typically permits full read, modification, and denial of service.

Because the CVE record carries no vendor-assigned CVSS score and EPSS has not been published, prioritization should treat this as an unpatched, authenticated RCE in an OT edge device — a category that justifies expedited remediation regardless of a missing numeric score. CISA KEV status is NO, so there is no confirmed in-the-wild exploitation signal; however, absence from KEV reflects a lack of reported exploitation, not an absence of risk.

Detection Guidance

Sigma Rule

title: Advantech EKI-1242EIMS Modbus CSV Import Code Injection (CVE-2026-73170) id: 8f2c1e04-7a9b-4d1f-9c3e-advantech73170 status: experimental description: Detects use of the Modbus CSV import workflow on Advantech EKI-1242EIMS, the vector for CVE-2026-73170 code injection. references:

• https://nvd.nist.gov/vuln/detail/CVE-2026-73170 author: Valters IT Threat Intelligence date: 2026/01/01 tags:
• attack.t1190
• cve.2026-73170 logsource: category: webserver product: advantech detection: selection_method: cs-method:
  • POST
  • PUT selection_uri: cs-uri-stem|contains:
  • 'import'
  • 'modbus'
  • 'csv'
  • 'upload'
  • 'config' selection_file: cs-uri-query|contains: '.csv' condition: selection_method and (selection_uri or selection_file) fields:
• c-ip
• cs-uri-stem
• cs-uri-query
• sc-status falsepositives:
• Legitimate administrator importing Modbus point maps during maintenance windows level: medium

YARA Rule

rule CVE_2026_73170_Advantech_EKI_Modbus_CSV_Lua_Injection
{
    meta:
        description = "Detects Lua code injection payloads embedded in Modbus CSV import files targeting Advantech EKI-1242EIMS (CVE-2026-73170)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73170"
        date = "2026-01-01"
        severity = "high"

    strings:
        $lua1 = "os.execute" ascii nocase
        $lua2 = "io.popen" ascii nocase
        $lua3 = "loadstring" ascii nocase
        $lua4 = "require(" ascii nocase
        $lua5 = "dofile" ascii nocase
        $lua6 = "load(" ascii nocase

        $csv1 = ".csv" ascii nocase
        $csv2 = "register" ascii nocase
        $csv3 = "modbus" ascii nocase

        $shell1 = "/bin/sh" ascii
        $shell2 = "wget " ascii nocase
        $shell3 = "curl " ascii nocase
        $shell4 = "chmod +x" ascii nocase

    condition:
        (uint32(0) != 0x04034b50) and
        (
            (any of ($lua*) and any of ($csv*)) or
            (any of ($lua*) and any of ($shell*))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73170 Advantech EKI-1242EIMS Modbus CSV Import Lua Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"csv"; nocase; http.request_body; content:"os.execute"; nocase; http.request_body; content:"io.popen"; nocase; classtype:attempted-admin; reference:cve,2026-73170; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73170; sid:202673170; rev:1;)

Supplementary rule for multipart CSV uploads carrying Lua primitives: alert http any any -> any any (msg:"CVE-2026-73170 Suspicious Lua Constructs in File Upload to Advantech Device"; flow:established,to_server; http.method; content:"POST"; http.header; content:"multipart/form-data"; http.header; content:"filename="; http.client_body; content:"loadstring"; nocase; classtype:attempted-admin; reference:cve,2026-73170; sid:202673171; rev:1;)

Elastic Detection

process where event.type == "start" and process.parent.name in ("httpd", "lighttpd", "nginx", "lua", "luad") and process.name in ("sh", "bash", "busybox", "curl", "wget") and process.args : ("os.execute", "io.popen", "loadstring", "/bin/sh")

For web-log-based detection of the import vector: event.category: "web" and http.request.method in ("POST", "PUT") and url.path : ("import", "modbus", "csv", "upload") and http.response.status_code in (200, 201, 302)

Splunk SPL Query

index=web OR index=proxy | eval is_import=if(match(lower(uri_path), "import|modbus|csv|upload"), 1, 0) | where is_import=1 AND lower(http_method) IN ("post","put") | stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses values(src_ip) as client_ips values(uri_path) as paths by src_ip, dest_host | where count > 0 | sort - count

Correlation query joining device auth logs with subsequent shell activity: index=ot_devices (sourcetype=advantech* OR sourcetype=syslog) | search ("os.execute" OR "io.popen" OR "loadstring" OR "csv import" OR "modbus import") | table _time host src_ip user action message | sort - _time

Wazuh OSSEC Rule

web-accesslog import|modbus|csv|upload POST|PUT CVE-2026-73170: Possible Modbus CSV import abuse on Advantech EKI-1242EIMS T1190 cve_2026_73170,attempted_admin, web-accesslog os.execute|io.popen|loadstring|/bin/sh|chmod +x CVE-2026-73170: Lua code-injection payload observed in imported CSV content T1190 cve_2026_73170,code_injection, 202673170 200|201|302 CVE-2026-73170: CSV import request succeeded - possible successful exploitation cve_2026_73170,exploitation_success,

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, firmware update, or workaround has been published as of this report. The following guidance is defensive and does not rely on a vendor fix.

1. Immediate mitigations

• Remove EKI-1242EIMS management interfaces from untrusted networks. Restrict web/HTTPS management access to a dedicated, firewalled administrative VLAN with allow-list source addresses.
• Disable or block Modbus CSV import where operationally feasible until a fix is available. If the workflow must remain, treat every uploaded CSV as untrusted input.
• Enforce strong, unique credentials on all EKI-series devices and rotate any credentials that may have been shared. Eliminate default accounts.
• Disable unneeded services (Telnet, unauthenticated HTTP, unnecessary Modbus/TCP exposure on port 502 to east-west segments).
• Monitor for anomalous Lua execution and outbound connections from the device's management IP.

2. Patch / upgrade steps

• There is currently no available patch. Monitor Advantech's security advisories and the Nozomi Networks Labs disclosure channel for a fixed firmware release. Do not assume V1.06.01 or any later unverified version is safe.
• When a fixed firmware is released, stage and test in a lab replicating production Modbus topology before fleet-wide deployment.
• After any suspected exploitation, reflash firmware from a trusted source and audit device configuration for unauthorized modifications (routes, point mappings, scheduled tasks).

3. Long-term hardening

• Apply network segmentation aligned with IEC 62443 zones/conduits; never expose OT gateways directly to the internet or general IT networks.
• Deploy protocol-aware monitoring on Modbus links to baseline normal polling behavior and alert on point-map changes.
• Maintain an asset inventory of EKI-series devices with firmware baselines and subscribe to vendor PSIRT notifications.
• Restrict device management to authenticated, logged jump hosts with MFA.
• Implement least-privilege on the device where the firmware supports separate read-only and admin roles.
• Include OT gateways in vulnerability management and incident response runbooks; rehearse gateway-compromise scenarios.

References

1. NVD — CVE-2026-73170: https://nvd.nist.gov/vuln/detail/CVE-2026-73170
2. Nozomi Networks Labs — original vulnerability research/disclosure (named as the discovering party in the CVE record)
3. Advantech Security Advisory portal — vendor advisories for EKI-1242EIMS (monitor for a fixed firmware release; none published at time of writing)
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
6. CISA Known Exploited Vulnerabilities catalog — no KEV entry for CVE-2026-73170 at time of writing; no known threat actor campaign or exploit-in-the-wild evidence is associated with this CVE in the provided data.

[ API_PRO ] →

◈ SOURCE Analysis & enrichment: valtersit.com/cve/CVE-2026-73170/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub